php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #75967 A crash occurs in ucrtbase.dll
Submitted: 2018-02-16 05:27 UTC Modified: 2018-06-24 04:25 UTC
Votes:13
Avg. Score:4.7 ± 0.6
Reproduced:13 of 13 (100.0%)
Same Version:2 (15.4%)
Same OS:8 (61.5%)
From: bbent67888 at mail dot com Assigned:
Status: No Feedback Package: IIS related
PHP Version: 7.2.2 OS: Windows Server 2016
Private report: No CVE-ID: None
 [2018-02-16 05:27 UTC] bbent67888 at mail dot com
Description:
------------
I see a random crash in my Windows Event Viewer. There is nothing in my PHP error log. This indicates a problem interacting with the MS C runtime.

Faulting application name: php-cgi.exe, version: 7.2.2.0, time stamp: 0x5a7219e5
Faulting module name: ucrtbase.dll, version: 10.0.14393.1770, time stamp: 0x59bf2b6f
Exception code: 0xc0000005
Fault offset: 0x000000000001f084
Faulting process id: 0x17f4
Faulting application start time: 0x01d3a6b90e8b807f
Faulting application path: C:\Program Files\PHP\7.2\php-cgi.exe
Faulting module path: C:\Windows\System32\ucrtbase.dll
Report Id: 8afb697e-1cd0-43cd-a9e8-067f9fd96d6e
Faulting package full name: 
Faulting package-relative application ID: 

Test script:
---------------
Not sure how to reproduce. Happy to try if you can find a hint from that crash trace.


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2018-02-16 11:42 UTC] ab@php.net
-Status: Open +Status: Feedback
 [2018-02-16 11:42 UTC] ab@php.net
Thank you for this bug report. To properly diagnose the problem, we
need a backtrace to see what is happening behind the scenes. To
find out how to generate a backtrace, please read
http://bugs.php.net/bugs-generating-backtrace.php for *NIX and
http://bugs.php.net/bugs-generating-backtrace-win32.php for Win32

Once you have generated a backtrace, please submit it to this bug
report and change the status back to "Open". Thank you for helping
us make PHP better.

A few points yet were

- if possible, please provide a crash dump, too
- a repro script might be good needed, too
- be sure you don't enable Xdebug and Opcache simultaneously

Thanks.
 [2018-02-18 05:24 UTC] bbent67888 at mail dot com
-Status: Feedback +Status: Open
 [2018-02-18 05:24 UTC] bbent67888 at mail dot com
Hi ab, I don't think I will be able to reproduce it to get more information.
I was hoping you could give me a hint based on the information I provided so I can try.

I checked request logs and the error seems to have originated through a cache clearing function in a WordPress plugin.
 [2018-02-19 10:45 UTC] ab@php.net
-Status: Open +Status: Feedback
 [2018-02-19 10:45 UTC] ab@php.net
Not enough information was provided for us to be able
to handle this bug. Please re-read the instructions at
http://bugs.php.net/how-to-report.php

If you can provide more information, feel free to add it
to this bug and change the status back to "Open".

Thank you for your interest in PHP.



 [2018-06-24 04:25 UTC] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
 [2020-02-03 08:47 UTC] jasmin dot mistry at flydocs dot aero
We are frequently facing this issue. I have attached error trace. 

dumpproc version 1.183.150.20200121-122833, installer version 1.183.151.20200121-171844

time: 2020.02.03 06:05:14 UTC, processId: 965344, path: ***\Zend\ZendServer\bin\php-cgi.exe
Exception 0xc0000409: The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.



threadId 0xe94dc - stack: 04415000-04423000, size: 56 kB, CAUSED EXCEPTION
  0x0441D798 0x719884CB ucrtbase!abort+0x4b
  0x0441D7B0 0x71987DBB ucrtbase!terminate+0x3b
  0x0441D7E4 0x004086CB php-cgi!OPENSSL_Applink+0x761b
  0x0441D7EC 0x753CF095 KERNELBASE!UnhandledExceptionFilter+0x165
  0x0441D874 0x7783F284 ntdll!LdrSetAppCompatDllRedirectionCallback+0x13454
  0x0441FFE4 0x777EAD5A ntdll!RtlInitializeExceptionChain+0x5a
threadId 0xeb094 - stack: 08B0F000-08B11000, size: 8 kB
  0x08B0FEF0 0x777CC33C ntdll!ZwWaitForSingleObject+0xc
  0x08B0FF68 0x75312C02 KERNELBASE!WaitForSingleObject+0x12
  0x08B0FF7C 0x00406B7C php-cgi!OPENSSL_Applink+0x5acc
  0x08B0FF9C 0x777EAD8F ntdll!RtlInitializeExceptionChain+0x8f
  0x08B0FFE4 0x777EAD5A ntdll!RtlInitializeExceptionChain+0x5a
threadId 0xeef54 - stack: 0EB5F000-0EB60000, size: 4 kB
  0x0EB5FF40 0x777CC38C ntdll!ZwRemoveIoCompletion+0xc
  0x0EB5FF88 0x757E6A14 KERNEL32!BaseThreadInitThunk+0x24
  0x0EB5FF9C 0x777EAD8F ntdll!RtlInitializeExceptionChain+0x8f
  0x0EB5FFE4 0x777EAD5A ntdll!RtlInitializeExceptionChain+0x5a

loaded modules:
  0x00350000-0002e000 ***\Zend\ZendServer\lib\ZendExtensionManager.dll (1.0.0.0)
  0x003F0000-0000b000 ***\Zend\ZendServer\lib\phpext\php_bcmath.dll (7.1.33.0)
  0x00400000-00012000 ***\Zend\ZendServer\bin\php-cgi.exe (7.1.33.0)
  0x04800000-000c8000 ***\Zend\ZendServer\bin\ZendLib.dll (1.0.0.0)
  0x048E0000-0000b000 ***\Zend\ZendServer\lib\phpext\php_calendar.dll (7.1.33.0)
  0x08B30000-00019000 ***\Zend\ZendServer\lib\phpext\php_mysqli.dll (7.1.33.0)
  0x08B60000-0000b000 ***\Zend\ZendServer\lib\phpext\php_pdo_mysql.dll (7.1.33.0)
  0x08B80000-00039000 ***\Zend\ZendServer\lib\phpext\php_phar.dll (7.1.33.0)
  0x08BD0000-00013000 ***\Zend\ZendServer\lib\phpext\php_sockets.dll (7.1.33.0)
  0x08E00000-00117000 ***\Zend\ZendServer\lib\phpext\php_mbstring.dll (7.1.33.0)
  0x08F20000-0000a000 ***\Zend\ZendServer\lib\phpext\php_tokenizer.dll (7.1.33.0)
  0x08F40000-00015000 ***\Zend\ZendServer\lib\phpext\php_bz2.dll (7.1.33.0)
  0x08F70000-0014e000 ***\Zend\ZendServer\lib\phpext\php_gd2.dll (7.1.33.0)
  0x090E0000-0000f000 ***\Zend\ZendServer\lib\phpext\php_exif.dll (7.1.33.0)
  0x09100000-00054000 ***\Zend\ZendServer\lib\phpext\php_intl.dll (7.1.33.0)
  0x09170000-001be000 ***\Zend\ZendServer\bin\icuin57.dll (57.1.0.0)
  0x09360000-00010000 ***\Zend\ZendServer\lib\phpext\php_gettext.dll (7.1.33.0)
  0x09380000-00079000 ***\Zend\ZendServer\lib\phpext\php_tidy.dll (7.1.33.0)
  0x09410000-0000c000 ***\Zend\ZendServer\lib\phpext\php_pdo_pgsql.dll (7.1.33.0)
  0x09430000-0001b000 ***\Zend\ZendServer\lib\phpext\php_pgsql.dll (7.1.33.0)
  0x09460000-000cc000 ***\Zend\ZendServer\lib\phpext\php_imap.dll (7.1.33.0)
  0x09540000-0002f000 ***\Zend\ZendServer\lib\phpext\php_xsl.dll (7.1.33.0)
  0x09580000-00302000 ***\Zend\ZendServer\lib\phpext\php_fileinfo.dll (7.1.33.0)
  0x098A0000-0002f000 ***\Zend\ZendServer\lib\phpext\php_ldap.dll (7.1.33.0)
  0x10000000-00756000 ***\Zend\ZendServer\bin\php7.dll (7.1.33.0)
  0x4A800000-00131000 ***\Zend\ZendServer\bin\icuuc57.dll (57.1.0.0)
  0x4AB00000-0000f000 ***\Zend\ZendServer\bin\icuio57.dll (57.1.0.0)
  0x6E780000-0187d000 ***\Zend\ZendServer\bin\icudt57.dll (57.1.0.0)
  0x700F0000-00013000 ***\SYSTEM32\dhcpcsvc6.DLL (6.3.9600.19423)
  0x71350000-00028000 ***\Zend\ZendServer\bin\LIBPQ.dll (9.6.2.17037)
  0x71380000-00035000 ***\Zend\ZendServer\bin\libpng16.dll (1.6.20.0)
  0x713C0000-0004e000 ***\Zend\ZendServer\bin\libcurl.dll (7.47.1.0)
  0x71410000-0013e000 ***\Zend\ZendServer\bin\LIBEAY32.dll (1.0.2.19)
  0x71570000-00003000 ***\SYSTEM32\api-ms-win-crt-conio-l1-1-0.dll (10.0.14393.2247)
  0x71580000-00049000 ***\Zend\ZendServer\bin\SSLEAY32.dll (1.0.2.19)
  0x715D0000-00017000 ***\Zend\ZendServer\bin\libsasl.dll (2.1.25.0)
  0x715F0000-00015000 ***\Zend\ZendServer\bin\zlib.dll (1.2.8.0)
  0x71640000-00008000 ***\SYSTEM32\WSOCK32.dll (6.3.9600.17415)
  0x71650000-00014000 ***\SYSTEM32\dhcpcsvc.DLL (6.3.9600.19423)
  0x71870000-00021000 ***\SYSTEM32\DEVOBJ.dll (6.3.9600.17415)
  0x718A0000-00023000 ***\SYSTEM32\WINMMBASE.dll (6.3.9600.17415)
  0x718D0000-00023000 ***\SYSTEM32\WINMM.dll (6.3.9600.17415)
  0x71900000-000df000 ***\SYSTEM32\ucrtbase.DLL (10.0.14393.2990)
  0x719E0000-00005000 ***\SYSTEM32\api-ms-win-crt-multibyte-l1-1-0.dll (10.0.14393.2247)
  0x719F0000-00003000 ***\SYSTEM32\api-ms-win-crt-environment-l1-1-0.dll (10.0.14393.2247)
  0x71A00000-00003000 ***\SYSTEM32\api-ms-win-crt-utility-l1-1-0.dll (10.0.14393.2247)
  0x71A10000-00004000 ***\SYSTEM32\api-ms-win-crt-string-l1-1-0.dll (10.0.14393.2247)
  0x71A20000-00003000 ***\SYSTEM32\api-ms-win-crt-filesystem-l1-1-0.dll (10.0.14393.2247)
  0x71A30000-00003000 ***\SYSTEM32\api-ms-win-crt-locale-l1-1-0.dll (10.0.14393.2247)
  0x71A40000-00003000 ***\SYSTEM32\api-ms-win-crt-heap-l1-1-0.dll (10.0.14393.2247)
  0x71A50000-00004000 ***\SYSTEM32\api-ms-win-crt-convert-l1-1-0.dll (10.0.14393.2247)
  0x71A60000-00005000 ***\SYSTEM32\api-ms-win-crt-math-l1-1-0.dll (10.0.14393.2247)
  0x71A70000-00003000 ***\SYSTEM32\api-ms-win-crt-time-l1-1-0.dll (10.0.14393.2247)
  0x71A80000-00004000 ***\SYSTEM32\api-ms-win-crt-stdio-l1-1-0.dll (10.0.14393.2247)
  0x71A90000-00004000 ***\SYSTEM32\api-ms-win-crt-runtime-l1-1-0.dll (10.0.14393.2247)
  0x71AA0000-00014000 ***\SYSTEM32\VCRUNTIME140.dll (14.11.25325.0)
  0x71AC0000-0006d000 ***\SYSTEM32\MSVCP140.dll (14.11.25325.0)
  0x71B30000-00467000 ***\Zend\ZendServer\bin\Qt5Core.dll (5.5.1.0)
  0x71FA0000-0002b000 ***\Zend\ZendServer\bin\Qt5Sql.dll (5.5.1.0)
  0x71FD0000-000d5000 ***\Zend\ZendServer\bin\Qt5Network.dll (5.5.1.0)
  0x720B0000-00029000 ***\Zend\ZendServer\bin\Qt5Xml.dll (5.5.1.0)
  0x721D0000-0001b000 ***\Zend\ZendServer\bin\zip.dll (0.0.0.0)
  0x72240000-00014000 ***\system32\NLAapi.dll (6.3.9600.18895)
  0x72260000-00011000 ***\system32\napinsp.dll (6.3.9600.17415)
  0x72280000-00046000 ***\System32\fwpuclnt.dll (6.3.9600.18229)
  0x722D0000-00008000 ***\System32\rasadhlp.dll (6.3.9600.17415)
  0x723C0000-0004b000 ***\system32\mswsock.dll (6.3.9600.18340)
  0x72410000-0000a000 ***\System32\winrnr.dll (6.3.9600.17415)
  0x73120000-0007e000 ***\SYSTEM32\DNSAPI.dll (6.3.9600.19060)
  0x73960000-00141000 ***\SYSTEM32\dbghelp.dll (6.3.9600.17787)
  0x73AB0000-0001e000 ***\SYSTEM32\bcrypt.dll (6.3.9600.18541)
  0x743E0000-00028000 ***\SYSTEM32\ntmarta.dll (6.3.9600.17415)
  0x74690000-00008000 ***\SYSTEM32\VERSION.dll (6.3.9600.17415)
  0x74740000-00016000 ***\SYSTEM32\MPR.dll (6.3.9600.17415)
  0x74AE0000-00008000 ***\SYSTEM32\WINNSI.DLL (6.3.9600.17415)
  0x74AF0000-00020000 ***\SYSTEM32\IPHLPAPI.DLL (6.3.9600.18264)
  0x74B70000-0000a000 ***\SYSTEM32\Secur32.dll (6.3.9600.17415)
  0x74F00000-00054000 ***\SYSTEM32\bcryptPrimitives.dll (6.3.9600.18895)
  0x74F60000-0000a000 ***\SYSTEM32\CRYPTBASE.dll (6.3.9600.17415)
  0x74FE0000-0007c000 ***\SYSTEM32\ADVAPI32.dll (6.3.9600.18895)
  0x75270000-00054000 ***\SYSTEM32\WLDAP32.dll (6.3.9600.19028)
  0x752D0000-0003c000 ***\SYSTEM32\cfgmgr32.dll (6.3.9600.17415)
  0x75310000-000d7000 ***\SYSTEM32\KERNELBASE.dll (6.3.9600.19425)
  0x753F0000-00153000 ***\SYSTEM32\USER32.dll (6.3.9600.19540)
  0x75550000-00007000 ***\SYSTEM32\NSI.dll (6.3.9600.17415)
  0x75580000-00006000 ***\SYSTEM32\PSAPI.DLL (6.3.9600.17415)
  0x75590000-0004f000 ***\SYSTEM32\WS2_32.dll (6.3.9600.18340)
  0x75670000-000ba000 ***\SYSTEM32\RPCRT4.dll (6.3.9600.19538)
  0x757D0000-00140000 ***\SYSTEM32\KERNEL32.DLL (6.3.9600.19538)
  0x75920000-00188000 ***\SYSTEM32\CRYPT32.dll (6.3.9600.18653)
  0x75AB0000-0017d000 ***\SYSTEM32\combase.dll (6.3.9600.19227)
  0x75C30000-00045000 ***\SYSTEM32\SHLWAPI.dll (6.3.9600.17415)
  0x75C80000-0010c000 ***\SYSTEM32\GDI32.dll (6.3.9600.19539)
  0x75D90000-0001e000 ***\SYSTEM32\SspiCli.dll (6.3.9600.17415)
  0x75ED0000-000c3000 ***\SYSTEM32\msvcrt.dll (7.0.9600.17415)
  0x75FA0000-012bb000 ***\SYSTEM32\SHELL32.dll (6.3.9600.19377)
  0x77260000-00096000 ***\SYSTEM32\OLEAUT32.dll (6.3.9600.19460)
  0x77300000-00041000 ***\SYSTEM32\sechost.dll (6.3.9600.17734)
  0x773B0000-0000e000 ***\SYSTEM32\MSASN1.dll (6.3.9600.17415)
  0x77580000-00129000 ***\SYSTEM32\ole32.dll (6.3.9600.19345)
  0x776B0000-00005000 ***\SYSTEM32\Normaliz.dll (6.3.9600.17415)
  0x77790000-0016f000 ***\SYSTEM32\ntdll.dll (6.3.9600.18895)
 [2021-05-31 11:48 UTC] kazuye at jpoundoeoi dot com
We experience the same error when cycling the Wordpress function wp_update_user().
Here's the DebugDiag analysis result:

DebugDiag Analysis Report 

Dumps: 
2/2 

Rules: 
1/1 

2 Error
0 Warning
0 Information
4 Notification
  
Analysis Summary
 



 Error 


Description Recommendation 

In php-cgi.exe_210531_125249.dmp the assembly instruction at ucrtbase!abort+4e in C:\Windows\System32\ucrtbase.dll from Microsoft Corporation has caused an unknown exception (0xc0000409) on thread 11
 

Please follow up with vendor Microsoft Corporation for problem resolution concerning the following file: C:\Windows\System32\ucrtbase.dll. 
In php-cgi.exe_210531_125253.dmp the assembly instruction at ucrtbase!abort+4e in C:\Windows\System32\ucrtbase.dll from Microsoft Corporation has caused an unknown exception (0xc0000409) on thread 11
 

Please follow up with vendor Microsoft Corporation for problem resolution concerning the following file: C:\Windows\System32\ucrtbase.dll. 



 Notification 


Description Recommendation 

DebugDiag determined that this dump file (php-cgi.exe_210531_125249.dmp) is a crash dump and did not perform any hang analysis. To run both hang rules and crash rules on crash dumps, select the following option in the 'Preferences' tab of the 'Settings' page in DebugDiag.Analysis.exe:

    'For crash dumps, run hang rules and crash rules'  
DebugDiag determined that this dump file (php-cgi.exe_210531_125253.dmp) is a crash dump and did not perform any hang analysis. To run both hang rules and crash rules on crash dumps, select the following option in the 'Preferences' tab of the 'Settings' page in DebugDiag.Analysis.exe:

    'For crash dumps, run hang rules and crash rules'  

DebugDiag failed to locate the PEB (Process Environment Block) in php-cgi.exe_210531_125249.dmp, and as a result, debug analysis for this dump may be incomplete or inaccurate.

 It is recommended that you get another dump of the target process when the issue occurs to ensure accurate data is reported 

DebugDiag failed to locate the PEB (Process Environment Block) in php-cgi.exe_210531_125253.dmp, and as a result, debug analysis for this dump may be incomplete or inaccurate.

 It is recommended that you get another dump of the target process when the issue occurs to ensure accurate data is reported 
 

Analysis Details 


CrashHangAnalysis

Report for php-cgi.exe_210531_125249.dmp

Type of Analysis Performed Crash Analysis 
Machine Name  
Operating System Windows Server 2016 - 14393 
Number Of Processors  
Process ID 26320 
Process Image C:\PHP\php-cgi.exe 
Command Line "C:\PHP\php-cgi.exe" 
System Up-Time 31 day(s) 00:45:29 
Process Up-Time 00:00:03 
Processor Type X64 
Process Bitness 64-Bit 

Faulting Thread


Entry point   mso20win32client!Ordinal720+2d88 
Create time   31/05/2021 12:52:48 
Time spent in user mode   0 Days 0:0:0.0 
Time spent in kernel mode   0 Days 0:0:0.0 


ucrtbase!abort+4e     0007ff7`00000003     0000000`00000003     00000db`f0fffbf0     0000000`00000001    
ucrtbase!terminate+1f     0000000`00000080     0000000`00008000     0000020`00001000     0000000`01000000    
php_cgi+3cd7     0000000`00000000     0000000`00000001     0000000`00000000     0000000`00000001    
KERNELBASE!UnhandledExceptionFilter+157     0000000`00000000     0007fff`ad46e508     0000000`00000000     0007fff`9f724a00    
ntdll!RtlUserThreadStart$filt$0+38     0000000`00020002     0000006`00000001     0007fff`aa9184d4     00000db`f0fffb50    
ntdll!_C_specific_handler+96     0000000`00000000     00000db`f0ffdc70     00000db`f0ffeb00     00000db`f0ffeb00    
ntdll!RtlpExecuteHandlerForException+d     0007fff`aa9b4498     00000db`f0ffeb00     00001fb`5fefea00     0007fff`a1a9843e    
ntdll!RtlDispatchException+373     00000db`0c00000c     0007fff`6f4e3cb2     00000db`f0ffe2c0     00001fb`55950000    
ntdll!RtlRaiseException+2d9     00001fb`581830d0     0007fff`6f6a4310     00000db`f0fff7f0     00000db`f0fff280    
KERNELBASE!RaiseException+68     00000db`f0fff900     0007fff`6f5f91c3     00000db`f0fff280     00000db`f0fff669    
VCRUNTIME140!_CxxThrowException+ad [d:\agent\_work\2\s\src\vctools\crt\vcruntime\src\eh\throw.cpp @ 133]     0007fff`6f480000     00001fb`5fe2b0a0     00000db`f0fff900     0000000`00000000   d:\agent\_work\2\s\src\vctools\crt\vcruntime\src\eh\throw.cpp @ 133 
mso20win32client!Ordinal541+1e80c     00000db`f0fff660     00001fb`5fe2b0a0     00000db`f0fff7f0     00000db`f0fff900    
mso20win32client!Ordinal541+1ece0     1d7560b`191976b0     039a42c`43daf6b0     0000000`00000000     0000000`00000000    
mso20win32client!Ordinal1367+33563     0000000`00000000     0000000`00000000     0000000`00000000     0000000`00000000    
mso20win32client!Ordinal857+16db2     00001fb`5fe726b0     0000000`00000000     0000000`00000000     00001fb`5fe726b0    
mso20win32client!Ordinal857+8014     00001fb`5fe42900     0000000`00000000     00001fb`5816ce10     0007fff`6f4a2326    
mso20win32client!Ordinal857+7f91     0000000`00000000     0000000`00000000     0000000`00000000     0000000`00000000    
mso20win32client!Ordinal1301+6d6     0000000`00000000     00001fb`581a3f00     0000000`00000000     0000000`00000000    
mso20win32client!Ordinal182+420     00001fb`5fe51cf8     00001fb`581a3f08     00001fb`5fe83f80     0007fff`6f4b9cea    
mso20win32client!Ordinal182+337     00001fb`5fe51378     00001fb`5fe80cc0     00001fb`581875c0     0007fff`6f48f700    
mso20win32client!Ordinal899+cbf     00000db`f0fffb70     0000000`00000000     0000000`00000000     00000db`f0fffb70    
mso20win32client!Ordinal899+16ad     0000000`00000000     00001fb`5fdf92e0     0000000`00000000     00000db`f0fffb70    
mso20win32client!Ordinal720+2859     00001fb`000089e8     0000000`00000000     0000000`00000000     0000000`00000000    
mso20win32client!Ordinal720+2de4     0000000`00000000     0000000`00000000     0000000`00000000     0000000`00000000    
kernel32!BaseThreadInitThunk+14     0000000`00000000     0000000`00000000     0000000`00000000     0000000`00000000    
ntdll!RtlUserThreadStart+21     0000000`00000000     0000000`00000000     0000000`00000000     0000000`00000000    


CLR Information

Exception Information


In php-cgi.exe_210531_125249.dmp the assembly instruction at ucrtbase!abort+4e in C:\Windows\System32\ucrtbase.dll from Microsoft Corporation has caused an unknown exception (0xc0000409) on thread 11


Module Information 

Image Name: C:\Windows\System32\ucrtbase.dll   Symbol Type:  PDB 
Base address: 0x00000003`00905a4d   Time Stamp:  Sat Apr 11 05:59:29 2020  
Checksum: 0x00000000`00000000   Comments:   
COM DLL: False   Company Name:  Microsoft Corporation 
ISAPIExtension: False   File Description:  Microsoft® C Runtime Library 
ISAPIFilter: False   File Version:  10.0.14393.3659 (rs1_release_1.200410-1813) 
Managed DLL: False   Internal Name:  ucrtbase.dll 
VB DLL: False   Legal Copyright:  © Microsoft Corporation. All rights reserved. 
Loaded Image Name:  ucrtbase.dll   Legal Trademarks:   
Mapped Image Name:     Original filename:  ucrtbase.dll 
Module name:  ucrtbase   Private Build:   
Single Threaded:  False   Product Name:  Microsoft® Windows® Operating System 
Module Size:  976 KBytes   Product Version:  10.0.14393.3659 
Symbol File Name:  c:\symbols\ucrtbase.pdb\FB16A8A30FFD4D868EA1F6402B3143F81\ucrtbase.pdb   Special Build:  & 


Report for php-cgi.exe_210531_125253.dmp


Type of Analysis Performed Crash Analysis 
Machine Name  
Operating System Windows Server 2016 - 14393 
Number Of Processors  
Process ID 26320 
Process Image C:\PHP\php-cgi.exe 
Command Line "C:\PHP\php-cgi.exe" 
System Up-Time 31 day(s) 00:45:33 
Process Up-Time 00:00:07 
Processor Type X64 
Process Bitness 64-Bit 

Faulting Thread

Entry point   mso20win32client!Ordinal720+2d88 
Create time   31/05/2021 12:52:48 
Time spent in user mode   0 Days 0:0:0.0 
Time spent in kernel mode   0 Days 0:0:0.0 


ucrtbase!abort+4e     0007ff7`00000003     0000000`00000003     00000db`f0fffbf0     0000000`00000001    
ucrtbase!terminate+1f     0000000`00000080     0000000`00008000     0000020`00001000     0000000`01000000    
php_cgi+3cd7     0000000`00000000     0000000`00000001     0000000`00000000     0000000`00000001    
KERNELBASE!UnhandledExceptionFilter+157     0000000`00000000     0007fff`ad46e508     0000000`00000000     0007fff`9f724a00    
ntdll!RtlUserThreadStart$filt$0+38     0000000`00020002     0000006`00000001     0007fff`aa9184d4     00000db`f0fffb50    
ntdll!_C_specific_handler+96     0000000`00000000     00000db`f0ffdc70     00000db`f0ffeb00     00000db`f0ffeb00    
ntdll!RtlpExecuteHandlerForException+d     0007fff`aa9b4498     00000db`f0ffeb00     00001fb`5fefea00     0007fff`a1a9843e    
ntdll!RtlDispatchException+373     00000db`0c00000c     0007fff`6f4e3cb2     00000db`f0ffe2c0     00001fb`55950000    
ntdll!RtlRaiseException+2d9     00001fb`581830d0     0007fff`6f6a4310     00000db`f0fff7f0     00000db`f0fff280    
KERNELBASE!RaiseException+68     00000db`f0fff900     0007fff`6f5f91c3     00000db`f0fff280     00000db`f0fff669    
VCRUNTIME140!_CxxThrowException+ad [d:\agent\_work\2\s\src\vctools\crt\vcruntime\src\eh\throw.cpp @ 133]     0007fff`6f480000     00001fb`5fe2b0a0     00000db`f0fff900     0000000`00000000   d:\agent\_work\2\s\src\vctools\crt\vcruntime\src\eh\throw.cpp @ 133 
mso20win32client!Ordinal541+1e80c     00000db`f0fff660     00001fb`5fe2b0a0     00000db`f0fff7f0     00000db`f0fff900    
mso20win32client!Ordinal541+1ece0     1d7560b`191976b0     039a42c`43daf6b0     0000000`00000000     0000000`00000000    
mso20win32client!Ordinal1367+33563     0000000`00000000     0000000`00000000     0000000`00000000     0000000`00000000    
mso20win32client!Ordinal857+16db2     00001fb`5fe726b0     0000000`00000000     0000000`00000000     00001fb`5fe726b0    
mso20win32client!Ordinal857+8014     00001fb`5fe42900     0000000`00000000     00001fb`5816ce10     0007fff`6f4a2326    
mso20win32client!Ordinal857+7f91     0000000`00000000     0000000`00000000     0000000`00000000     0000000`00000000    
mso20win32client!Ordinal1301+6d6     0000000`00000000     00001fb`581a3f00     0000000`00000000     0000000`00000000    
mso20win32client!Ordinal182+420     00001fb`5fe51cf8     00001fb`581a3f08     00001fb`5fe83f80     0007fff`6f4b9cea    
mso20win32client!Ordinal182+337     00001fb`5fe51378     00001fb`5fe80cc0     00001fb`581875c0     0007fff`6f48f700    
mso20win32client!Ordinal899+cbf     00000db`f0fffb70     0000000`00000000     0000000`00000000     00000db`f0fffb70    
mso20win32client!Ordinal899+16ad     0000000`00000000     00001fb`5fdf92e0     0000000`00000000     00000db`f0fffb70    
mso20win32client!Ordinal720+2859     00001fb`000089e8     0000000`00000000     0000000`00000000     0000000`00000000    
mso20win32client!Ordinal720+2de4     0000000`00000000     0000000`00000000     0000000`00000000     0000000`00000000    
kernel32!BaseThreadInitThunk+14     0000000`00000000     0000000`00000000     0000000`00000000     0000000`00000000    
ntdll!RtlUserThreadStart+21     0000000`00000000     0000000`00000000     0000000`00000000     0000000`00000000    


CLR Information

Exception Information


In php-cgi.exe_210531_125253.dmp the assembly instruction at ucrtbase!abort+4e in C:\Windows\System32\ucrtbase.dll from Microsoft Corporation has caused an unknown exception (0xc0000409) on thread 11


Module Information 

Image Name: C:\Windows\System32\ucrtbase.dll   Symbol Type:  PDB 
Base address: 0x00000003`00905a4d   Time Stamp:  Sat Apr 11 05:59:29 2020  
Checksum: 0x00000000`00000000   Comments:   
COM DLL: False   Company Name:  Microsoft Corporation 
ISAPIExtension: False   File Description:  Microsoft® C Runtime Library 
ISAPIFilter: False   File Version:  10.0.14393.3659 (rs1_release_1.200410-1813) 
Managed DLL: False   Internal Name:  ucrtbase.dll 
VB DLL: False   Legal Copyright:  © Microsoft Corporation. All rights reserved. 
Loaded Image Name:  ucrtbase.dll   Legal Trademarks:   
Mapped Image Name:     Original filename:  ucrtbase.dll 
Module name:  ucrtbase   Private Build:   
Single Threaded:  False   Product Name:  Microsoft® Windows® Operating System 
Module Size:  976 KBytes   Product Version:  10.0.14393.3659 
Symbol File Name:  c:\symbols\ucrtbase.pdb\FB16A8A30FFD4D868EA1F6402B3143F81\ucrtbase.pdb   Special Build:  & 

 
Analysis Rule Summary 
 

Rule Name Status Details 

CrashHangAnalysis - v (2.3.1.1) Completed
 [2021-07-01 09:41 UTC] erynn45 at zueastergq dot com
Hi, we experience the same problem: a cycle on wp_update_user causes a crash in ucrtbase.dll. Note that in the same script we connect also to a MSAccess database to read data.

Here's the data analysis:


Error 


Description Recommendation 

In php-cgi.exe_210531_125249.dmp the assembly instruction at ucrtbase!abort+4e in C:\Windows\System32\ucrtbase.dll from Microsoft Corporation has caused an unknown exception (0xc0000409) on thread 11
 

Please follow up with vendor Microsoft Corporation for problem resolution concerning the following file: C:\Windows\System32\ucrtbase.dll. 



 Notification 


Description Recommendation 

DebugDiag determined that this dump file (php-cgi.exe_210531_125249.dmp) is a crash dump and did not perform any hang analysis. To run both hang rules and crash rules on crash dumps, select the following option in the 'Preferences' tab of the 'Settings' page in DebugDiag.Analysis.exe:

    'For crash dumps, run hang rules and crash rules'  

DebugDiag failed to locate the PEB (Process Environment Block) in php-cgi.exe_210531_125249.dmp, and as a result, debug analysis for this dump may be incomplete or inaccurate.

 It is recommended that you get another dump of the target process when the issue occurs to ensure accurate data is reported 
 

 


Analysis Details 






CrashHangAnalysis





Report for php-cgi.exe_210531_125249.dmp





Type of Analysis Performed Crash Analysis 
Machine Name  
Operating System Windows Server 2016 - 14393 
Number Of Processors  
Process ID 26320 
Process Image C:\PHP\php-cgi.exe 
Command Line "C:\PHP\php-cgi.exe" 
System Up-Time 31 day(s) 00:45:29 
Process Up-Time 00:00:03 
Processor Type X64 
Process Bitness 64-Bit 



Faulting Thread




Entry point   mso20win32client!Ordinal720+2d88 
Create time   31/05/2021 12:52:48 
Time spent in user mode   0 Days 0:0:0.0 
Time spent in kernel mode   0 Days 0:0:0.0 






    Arg 1

    Arg 2

    Arg 3

    Arg 4

  Source

ucrtbase!abort+4e     0007ff7`00000003     0000000`00000003     00000db`f0fffbf0     0000000`00000001    
ucrtbase!terminate+1f     0000000`00000080     0000000`00008000     0000020`00001000     0000000`01000000    
php_cgi+3cd7     0000000`00000000     0000000`00000001     0000000`00000000     0000000`00000001    
KERNELBASE!UnhandledExceptionFilter+157     0000000`00000000     0007fff`ad46e508     0000000`00000000     0007fff`9f724a00    
ntdll!RtlUserThreadStart$filt$0+38     0000000`00020002     0000006`00000001     0007fff`aa9184d4     00000db`f0fffb50    
ntdll!_C_specific_handler+96     0000000`00000000     00000db`f0ffdc70     00000db`f0ffeb00     00000db`f0ffeb00    
ntdll!RtlpExecuteHandlerForException+d     0007fff`aa9b4498     00000db`f0ffeb00     00001fb`5fefea00     0007fff`a1a9843e    
ntdll!RtlDispatchException+373     00000db`0c00000c     0007fff`6f4e3cb2     00000db`f0ffe2c0     00001fb`55950000    
ntdll!RtlRaiseException+2d9     00001fb`581830d0     0007fff`6f6a4310     00000db`f0fff7f0     00000db`f0fff280    
KERNELBASE!RaiseException+68     00000db`f0fff900     0007fff`6f5f91c3     00000db`f0fff280     00000db`f0fff669    
VCRUNTIME140!_CxxThrowException+ad [d:\agent\_work\2\s\src\vctools\crt\vcruntime\src\eh\throw.cpp @ 133]     0007fff`6f480000     00001fb`5fe2b0a0     00000db`f0fff900     0000000`00000000   d:\agent\_work\2\s\src\vctools\crt\vcruntime\src\eh\throw.cpp @ 133 
mso20win32client!Ordinal541+1e80c     00000db`f0fff660     00001fb`5fe2b0a0     00000db`f0fff7f0     00000db`f0fff900    
mso20win32client!Ordinal541+1ece0     1d7560b`191976b0     039a42c`43daf6b0     0000000`00000000     0000000`00000000    
mso20win32client!Ordinal1367+33563     0000000`00000000     0000000`00000000     0000000`00000000     0000000`00000000    
mso20win32client!Ordinal857+16db2     00001fb`5fe726b0     0000000`00000000     0000000`00000000     00001fb`5fe726b0    
mso20win32client!Ordinal857+8014     00001fb`5fe42900     0000000`00000000     00001fb`5816ce10     0007fff`6f4a2326    
mso20win32client!Ordinal857+7f91     0000000`00000000     0000000`00000000     0000000`00000000     0000000`00000000    
mso20win32client!Ordinal1301+6d6     0000000`00000000     00001fb`581a3f00     0000000`00000000     0000000`00000000    
mso20win32client!Ordinal182+420     00001fb`5fe51cf8     00001fb`581a3f08     00001fb`5fe83f80     0007fff`6f4b9cea    
mso20win32client!Ordinal182+337     00001fb`5fe51378     00001fb`5fe80cc0     00001fb`581875c0     0007fff`6f48f700    
mso20win32client!Ordinal899+cbf     00000db`f0fffb70     0000000`00000000     0000000`00000000     00000db`f0fffb70    
mso20win32client!Ordinal899+16ad     0000000`00000000     00001fb`5fdf92e0     0000000`00000000     00000db`f0fffb70    
mso20win32client!Ordinal720+2859     00001fb`000089e8     0000000`00000000     0000000`00000000     0000000`00000000    
mso20win32client!Ordinal720+2de4     0000000`00000000     0000000`00000000     0000000`00000000     0000000`00000000    
kernel32!BaseThreadInitThunk+14     0000000`00000000     0000000`00000000     0000000`00000000     0000000`00000000    
ntdll!RtlUserThreadStart+21     0000000`00000000     0000000`00000000     0000000`00000000     0000000`00000000    






CLR Information






Exception Information


In php-cgi.exe_210531_125249.dmp the assembly instruction at ucrtbase!abort+4e in C:\Windows\System32\ucrtbase.dll from Microsoft Corporation has caused an unknown exception (0xc0000409) on thread 11


Module Information 

Image Name: C:\Windows\System32\ucrtbase.dll   Symbol Type:  PDB 
Base address: 0x00000003`00905a4d   Time Stamp:  Sat Apr 11 05:59:29 2020  
Checksum: 0x00000000`00000000   Comments:   
COM DLL: False   Company Name:  Microsoft Corporation 
ISAPIExtension: False   File Description:  Microsoft® C Runtime Library 
ISAPIFilter: False   File Version:  10.0.14393.3659 (rs1_release_1.200410-1813) 
Managed DLL: False   Internal Name:  ucrtbase.dll 
VB DLL: False   Legal Copyright:  © Microsoft Corporation. All rights reserved. 
Loaded Image Name:  ucrtbase.dll   Legal Trademarks:   
Mapped Image Name:     Original filename:  ucrtbase.dll 
Module name:  ucrtbase   Private Build:   
Single Threaded:  False   Product Name:  Microsoft® Windows® Operating System 
Module Size:  976 KBytes   Product Version:  10.0.14393.3659 
Symbol File Name:  c:\symbols\ucrtbase.pdb\FB16A8A30FFD4D868EA1F6402B3143F81\ucrtbase.pdb   Special Build:  & 


  

 



Analysis Rule Summary 
 

Rule Name Status Details 

CrashHangAnalysis - v (2.3.1.1) Completed
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Dec 21 13:01:31 2024 UTC